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-- The MAILING DATE of this communication appears on the cover sheet with the correspondence address - 
Period for Reply 



A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) FROM 
THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 .136(a). In no event, however, may a reply be timely filed 
after SIX (6) MONTHS from the mailing date of this communication. 

- If the period for reply specified above is less than thirty (30) days, a reply within the statutory minimum of thirty (30) days will be considered timely. 

- If NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 133). 
Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
earned patent term adjustment. See 37 CFR 1.704(b). 

Status 

1 )[3 Responsive to communication(s) filed on 27 September 2004 . 
2a)M This action is FINAL. 2b)D This action is non-final. 

3) D Since this application is in condition for allowance except for formal matters, prosecution as to the merits is 

closed in accordance with the practice under Ex parte Quay/e, 1935 CD. 11, 453 O.G. 213. 

Disposition of Claims 

4) [3 Claim(s) 1-32 is/are pending in the application. 

4a) Of the above claim(s) 20-25 is/are withdrawn from consideration. 

5) D Claim(s) is/are allowed. 

6) E3 Claim(s) 1-19 and 26-32 is/are rejected. 

7) D Claim(s) J is/are objected to. 

8) D Claim(s) are subject to restriction and/or election requirement. 

Application Papers 

9) D The specification is objected to by the Examiner. 

10)S The drawing(s) filed on 27 September 2004 is/are: a)M accepted or b)D objected to by the Examiner. 
Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1.85(a). 
Replacement drawing sheet(s) including the correction is required if the drawing(s) is objected to. See 37 CFR 1.121(d). 
The oath or declaration is objected to by the Examiner. Note the attached Office Action or form PTO-152. 

Priority under 35 U.S.C. § 119 

12)D Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 119(a)-(d) or(f). 
a)D All b)D Some * c)D None of: 

1 .□ Certified copies of the priority documents have been received. 

2. D Certified copies of the priority documents have been received in Application No. . 

3. D Copies of the certified copies of the priority documents have been received in this National Stage 

application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 
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DETAILED ACTION 



Claims 1-19 and 26-32 are presented for examination. 
Claims 1-19 and 26-27 are currently amended. 
Claims 20-25 are cancelled. 
Claims 28-32 are newly added. 



Claim Rejections - 35 USC § 103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 102 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner in which the invention was made. 

Claims 1-19, and 26-32 are rejected under 35 U.S.C. 103(a) as being 

unpatentable over Bruins et al (US Patent 6,308,148) in view of Merriam (US Patent 

6,587,878). 



Claim(s) 1 , 10, 19, 28: Bruins teaches a method to monitor a network by a network 

monitor, comprising: 

receiving data packet flow records from at least one network router (col. 2, lines 
23-24; wherein the router is collecting flow information to be used); 



filtering said flow records (col. 2, lines 36-40); and 
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extracting packet information from said filtered flow records (col. 3, lines 66-67) 
or from at least a fraction of said received flow records (col. 2, lines 35-45; 
wherein the fraction of said received flow records is the subset of total set of 
flows), wherein said extracted packet information comprises information of at 
least one target of interest (col. 4, lines 9-17; wherein the target of interest is the 
selected range of source addresses that originate from the internet domain 
"cisco.com" or in the second case, the target of interest is the selected protocol 
type such as the "FTP" protocol). 

Bruins, however, does not explicitly teach performing active measurements of 
said at least one target of interest based on said extracted packet information. 
Bruins does, however, suggest adjusting features or parameters based on 
aggregated flow information of the network to improve performance (Abstract of 
Bruins, next to last sentence & Claim 5 of Bruins). 

Marriam, in an analogous art, teaches a performance measurement program to 
measure actual performance data (col. 5, lines 29-31 and col. 9, lines 45-50). 
It would have been obvious to one of ordinary skill in the art at the time of the 
invention to combine Bruins' method of extracting packet information from the 
filtered flow records with Marriam's performance measurement program to 
measure actual performance data extracted from the filter. One of ordinary skill 
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in the art would recognized that the combination of exporting Bruin's network flow 
data with Marriam's performance measurement program would produce an 
advantage of improving the network performance or make the network perform 
more efficiently (Abstract of Bruins, next to last sentence & Claim 5 of Bruins). 

Claim(s) 2,11: Bruins and Marriam teach the method according to claim 1,10, said 
filtering step comprising: 

selecting flow records based on packet routing information in said received flow 

records (col. 2, lines 24-25 Bruins). 

Claim(s) 3, 1 2: Bruins and Marriam teach the method according to claim 2,11, said 
filtering comprising 

selecting flow records having non-local destination or source addresses (col. 3, 
lines 21-23 Bruins; wherein the destination are host from the "internet" which 
implies non-local and local hosts. It is well known in the art that a method can 
filter flow records that have source and/or destination host from a local subnet or 
other subnets). 

Claim(s) 4, 1 3: Bruins and Marriam teach the method according to claim 2,11, said 
filtering comprising 

selecting flow records having local destination or source addresses (col. 3, lines 
21-23 Bruins; wherein the destination are host from the "internet" which implies 
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non-local and local hosts. It is well known in the art that a method can filter flow 
records that have source and/or destination host from a local subnet or other 
subnets). 

Claim(s) 5, 14: Bruins and Marriam teach the method according to claim 2,11, said 

filtering step comprising: 

selecting flow records having destination or source addresses associated with 
performing critical services (col. 2, lines 28-32 and col. 3, lines 25-39 Bruins; 
wherein the critical servers are file transfer, electronic mail, and http services). 

Claim(s) 6, 15: Bruins and Marriam teach the method according to claim 1,10, said 

filtering step comprising: 

randomly selecting flow records from said received flow records (col. 2, lines 36- 
38; wherein each filter randomly selects only a subset of the total flows). 

Claim(s) 7, 8, 16, 17, 26, 27: Bruins and Marriam teach the method according to claim 
1,10,19, 

said active measurement comprise a ping and a traceroute process (Official 
Notice is taken of active measurement comprise ping and traceroute process. It 
is well known in the art at the time of the invention to use these processes in 
active measurement of network performance. It is also state in Marriam in col. 1, 
lines 60-61). 
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Claim(s) 9 t 18: Bruins and Marriam teach the method according to claim 1,10, further 
comprising 

selecting the nature of said active measurements based on said target of interest 
(col. 5, lines 29-31 and col. 9, lines 45-50 and FIG. 1, ref. Server probe and 
remote probes of Marriam). 



Claim(s) 29, 30, 31, 32: Bruins and Marriam teach the method according to claim 1,10, 

19, 28 further comprising: 

routing said data packets through said at least one router (col. 2, lines 20-21 
Bruins; wherein the function of a router is to route data packets through its 
interfaces); and 

generating said data packet flow records (col. 2, lines 23-24 Bruins; wherein the 
router is collecting or generating flow information to be used. Flow information 
are information about data packets). 



Response to Amendment 

Applicant's arguments filed 9/27/2004 have been fully considered but they are 
not persuasive. 
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In the Remarks, Applicant argued that 

(a) the Examiner has improperly combined the teachings of Bruins and Merriam 
and that there is no suggestion or motivation in combining the references and 
that the Examiner uses impermissible hindsight to combine. 
As to point (a), the Examiner is aware of the impermissible hindsight suggestions 
or motivations to combine. The Examiner is not just stating that the suggestion 
- or motivation to combine is to improve the efficiently of the network, but the 
Examiner also pointed out that the suggestion or motivation to combine Bruins' 
method of extracting packet information from the filtered flow records with 
Marriam's performance measurement program to measure actual performance 
data extracted from the filter is in the Abstract of Bruins (next to last sentence & 
Claim 5 of Bruins). After reading the citation, one of ordinary skill in the art at the 
time of the invention would recognized that when adjusting the network 
performance parameters of the network, one would try to improve its efficiency in 
terms of performance, and not try to degrade its performance nor adjusting the 
performance parameters just for the sake of adjusting. The Examiner has 
rewritten the suggestion or motivation to combine so that the Applicant can have 
a better view of where the suggestion or motivation is coming from. So, the 
Examiner is not just merely stating the obvious suggestion or motivation to 
combine, but also pointed out in the prior art which emphatically and clearly 
states it. 
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(b) Bruins is focused on providing an improved system for analyzing large 
amount of data packet flow data, whereas Merriam is focused on providing an 
improved system for performing active tests on network devices, and that there is 
no suggestion in Bruins and Merriam to provide a system that performs both of 
these functions. 

As to point (b), Bruins is focused on providing an improved system for analyzing 
large amount of flow data and the flow data contain source and destination 
address, and also layer 4 services encompassing file transfer, electronic mail, 
and http services (col. 2, lines 28-32 and col. 3, lines 25-39 Bruins; wherein the 
servers are file transfer, electronic mail, and http services). Merriam is focused 
on providing an improved system for performing active test on network devices 
(as the Applicant stated) that host web and http services to test for its 
connectivity and efficiency. With a suggestion that Bruins is collecting flow data 
containing layer 4 services including web and http services and Merriam is 
performing active test on network devices hosting web and http services, there is 
a strong tie and motivation to combine. 

With a strong motivation and suggestion to combine, the 103 rejection stands. 
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Conclusion 

THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time 
policy as set forth in 37 CFR 1 .1 36(a). 

A shortened statutory period for reply to this final action is set to expire THREE 
MONTHS from the mailing date of this action. In the event a first reply is filed within 
TWO MONTHS of the mailing date of this final action and the advisory action is not 
mailed until after the end of the THREE-MONTH shortened statutory period, then the 
shortened statutory period will expire on the date the advisory action is mailed, and any 
extension fee pursuant to 37 CFR 1 .136(a) will be calculated from the mailing date of 
the advisory action. In no event, however, will the statutory period for reply expire later 
than SIX MONTHS from the mailing date of this final action. 

Any inquiry concerning this communication or earlier communications from the 
Examiner should be directed to Tan Lien whose telephone number is (703) 305- 
6018. The examiner can normally be reached on Monday-Thursday from 8:30am to 
6pm. The examiner can also be reached on alternate Fridays. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Rupal Dharia, can be reached at (703) 305-4003. The fax phone 
number for this Group is (703) 305-3718. 

Communications via Internet e-mail regarding this application, other than those 
under 35 U.S.C. 132 or which otherwise require a signature, may be used by the 
applicant and should be addressed to [tan.lien@uspto.gov]. 
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All Internet e-mail communications will be made of record in the application file. 
PTO employees do not engage in Internet communications where there exists a 
possibility that sensitive information could be identified or exchanged unless the 
record includes a properly signed express waiver of the confidentiality requirements 
of 35 U.S.C. 122. This is more clearly set forth in the Interim Internet Usage Policy 
published in the Official Gazette of the Patent and Trademark on February 25, 1997 
at 1195 OG 89. 

Any inquiry of a general nature or relating to the status of this application or 
proceeding should be directed to the Group receptionist whose telephone number is 
(703) 305-3900. 
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